feat: Q4 测试覆盖 + 插件生态 — 集成测试/E2E/进销存插件/热更新

Q4 成熟度路线图全部完成:

1. 集成测试框架 (Testcontainers + PostgreSQL):
   - auth_tests: 用户 CRUD、租户隔离、用户名唯一性
   - plugin_tests: 动态表创建查询、租户数据隔离

2. Playwright E2E 测试:
   - 登录页面渲染和表单验证测试
   - 用户管理、插件管理、多租户隔离占位测试

3. 进销存插件 (erp-plugin-inventory):
   - 6 实体: 产品/仓库/库存/供应商/采购单/销售单
   - 12 权限、6 页面、完整 manifest
   - WASM 编译验证通过

4. 插件热更新:
   - POST /api/v1/admin/plugins/{id}/upgrade
   - manifest 对比 + 增量 DDL + WASM 热加载
   - 失败保持旧版本继续运行

5. 文档更新: CLAUDE.md + wiki/index.md 同步 Q2-Q4 进度

crates/erp-server/tests/integration/auth_tests.rs

@@ -0,0 +1,129 @@
+use erp_auth::dto::CreateUserReq;
+use erp_auth::service::user_service::UserService;
+use erp_core::events::EventBus;
+use erp_core::types::Pagination;
+
+use super::test_db::TestDb;
+
+#[tokio::test]
+async fn test_user_crud() {
+    let test_db = TestDb::new().await;
+    let db = &test_db.db;
+    let tenant_id = uuid::Uuid::new_v4();
+    let operator_id = uuid::Uuid::new_v4();
+    let event_bus = EventBus::new(100);
+
+    // 创建用户
+    let user = UserService::create(
+        tenant_id,
+        operator_id,
+        &CreateUserReq {
+            username: "testuser".to_string(),
+            password: "TestPass123".to_string(),
+            email: Some("test@example.com".to_string()),
+            phone: None,
+            display_name: Some("测试用户".to_string()),
+        },
+        db,
+        &event_bus,
+    )
+    .await
+    .expect("创建用户失败");
+
+    assert_eq!(user.username, "testuser");
+    assert_eq!(user.status, "active");
+
+    // 按 ID 查询
+    let found = UserService::get_by_id(user.id, tenant_id, db)
+        .await
+        .expect("查询用户失败");
+    assert_eq!(found.username, "testuser");
+    assert_eq!(found.email, Some("test@example.com".to_string()));
+
+    // 列表查询
+    let (users, total) = UserService::list(
+        tenant_id,
+        &Pagination {
+            page: Some(1),
+            page_size: Some(10),
+        },
+        None,
+        db,
+    )
+    .await
+    .expect("用户列表查询失败");
+    assert_eq!(total, 1);
+    assert_eq!(users[0].username, "testuser");
+}
+
+#[tokio::test]
+async fn test_tenant_isolation() {
+    let test_db = TestDb::new().await;
+    let db = &test_db.db;
+    let tenant_a = uuid::Uuid::new_v4();
+    let tenant_b = uuid::Uuid::new_v4();
+    let operator_id = uuid::Uuid::new_v4();
+    let event_bus = EventBus::new(100);
+
+    // 租户 A 创建用户
+    let user_a = UserService::create(
+        tenant_a,
+        operator_id,
+        &CreateUserReq {
+            username: "user_a".to_string(),
+            password: "Pass123456".to_string(),
+            email: None,
+            phone: None,
+            display_name: None,
+        },
+        db,
+        &event_bus,
+    )
+    .await
+    .unwrap();
+
+    // 租户 B 列表查询不应看到租户 A 的用户
+    let (users_b, total_b) = UserService::list(
+        tenant_b,
+        &Pagination {
+            page: Some(1),
+            page_size: Some(10),
+        },
+        None,
+        db,
+    )
+    .await
+    .unwrap();
+    assert_eq!(total_b, 0);
+    assert!(users_b.is_empty());
+
+    // 租户 B 通过 ID 查询租户 A 的用户应返回错误
+    let result = UserService::get_by_id(user_a.id, tenant_b, db).await;
+    assert!(result.is_err());
+}
+
+#[tokio::test]
+async fn test_username_uniqueness_within_tenant() {
+    let test_db = TestDb::new().await;
+    let db = &test_db.db;
+    let tenant_id = uuid::Uuid::new_v4();
+    let operator_id = uuid::Uuid::new_v4();
+    let event_bus = EventBus::new(100);
+
+    let req = CreateUserReq {
+        username: "duplicate".to_string(),
+        password: "Pass123456".to_string(),
+        email: None,
+        phone: None,
+        display_name: None,
+    };
+
+    // 第一次创建成功
+    UserService::create(tenant_id, operator_id, &req, db, &event_bus)
+        .await
+        .expect("创建用户应成功");
+
+    // 同租户重复用户名应失败
+    let result = UserService::create(tenant_id, operator_id, &req, db, &event_bus).await;
+    assert!(result.is_err());
+}

crates/erp-server/tests/integration/plugin_tests.rs

@@ -0,0 +1,190 @@
+use erp_plugin::dynamic_table::DynamicTableManager;
+use erp_plugin::manifest::{
+    PluginEntity, PluginField, PluginFieldType, PluginManifest, PluginMetadata, PluginSchema,
+};
+use sea_orm::{ConnectionTrait, FromQueryResult};
+
+use super::test_db::TestDb;
+
+/// 构造一个最小默认值的 PluginField（外部 crate 无法使用 #[cfg(test)] 的 default_for_field）
+fn make_field(name: &str, field_type: PluginFieldType) -> PluginField {
+    PluginField {
+        name: name.to_string(),
+        field_type,
+        required: false,
+        unique: false,
+        default: None,
+        display_name: None,
+        ui_widget: None,
+        options: None,
+        searchable: None,
+        filterable: None,
+        sortable: None,
+        visible_when: None,
+        ref_entity: None,
+        ref_label_field: None,
+        ref_search_fields: None,
+        cascade_from: None,
+        cascade_filter: None,
+        validation: None,
+        no_cycle: None,
+        scope_role: None,
+    }
+}
+
+/// 构建测试用 manifest
+fn make_test_manifest() -> PluginManifest {
+    PluginManifest {
+        metadata: PluginMetadata {
+            id: "erp-test".to_string(),
+            name: "测试插件".to_string(),
+            version: "0.1.0".to_string(),
+            description: "集成测试用".to_string(),
+            author: "test".to_string(),
+            min_platform_version: None,
+            dependencies: vec![],
+        },
+        schema: Some(PluginSchema {
+            entities: vec![PluginEntity {
+                name: "item".to_string(),
+                display_name: "测试项".to_string(),
+                fields: vec![
+                    PluginField {
+                        name: "code".to_string(),
+                        field_type: PluginFieldType::String,
+                        required: true,
+                        unique: true,
+                        display_name: Some("编码".to_string()),
+                        searchable: Some(true),
+                        ..make_field("code", PluginFieldType::String)
+                    },
+                    PluginField {
+                        name: "name".to_string(),
+                        field_type: PluginFieldType::String,
+                        required: true,
+                        display_name: Some("名称".to_string()),
+                        searchable: Some(true),
+                        ..make_field("name", PluginFieldType::String)
+                    },
+                    PluginField {
+                        name: "status".to_string(),
+                        field_type: PluginFieldType::String,
+                        filterable: Some(true),
+                        display_name: Some("状态".to_string()),
+                        ..make_field("status", PluginFieldType::String)
+                    },
+                    PluginField {
+                        name: "sort_order".to_string(),
+                        field_type: PluginFieldType::Integer,
+                        sortable: Some(true),
+                        display_name: Some("排序".to_string()),
+                        ..make_field("sort_order", PluginFieldType::Integer)
+                    },
+                ],
+                indexes: vec![],
+                relations: vec![],
+                data_scope: None,
+            }],
+        }),
+        events: None,
+        ui: None,
+        permissions: None,
+    }
+}
+
+#[tokio::test]
+async fn test_dynamic_table_create_and_query() {
+    let test_db = TestDb::new().await;
+    let db = &test_db.db;
+
+    let manifest = make_test_manifest();
+    let entity = &manifest.schema.as_ref().unwrap().entities[0];
+
+    // 创建动态表
+    DynamicTableManager::create_table(db, "erp_test", entity)
+        .await
+        .expect("创建动态表失败");
+
+    let table_name = DynamicTableManager::table_name("erp_test", &entity.name);
+
+    // 验证表存在
+    let exists = DynamicTableManager::table_exists(db, &table_name)
+        .await
+        .expect("检查表存在失败");
+    assert!(exists, "动态表应存在");
+
+    // 插入数据
+    let tenant_id = uuid::Uuid::new_v4();
+    let user_id = uuid::Uuid::new_v4();
+    let data = serde_json::json!({
+        "code": "ITEM001",
+        "name": "测试项目",
+        "status": "active",
+        "sort_order": 1
+    });
+
+    let (sql, values) = DynamicTableManager::build_insert_sql(&table_name, tenant_id, user_id, &data);
+    db.execute(sea_orm::Statement::from_sql_and_values(
+        sea_orm::DatabaseBackend::Postgres,
+        sql,
+        values,
+    ))
+    .await
+    .expect("插入数据失败");
+
+    // 查询数据
+    let (sql, values) = DynamicTableManager::build_query_sql(&table_name, tenant_id, 10, 0);
+    #[derive(FromQueryResult)]
+    struct Row {
+        id: uuid::Uuid,
+        data: serde_json::Value,
+    }
+    let rows = Row::find_by_statement(sea_orm::Statement::from_sql_and_values(
+        sea_orm::DatabaseBackend::Postgres,
+        sql,
+        values,
+    ))
+    .all(db)
+    .await
+    .expect("查询数据失败");
+
+    assert_eq!(rows.len(), 1);
+    assert_eq!(rows[0].data["code"], "ITEM001");
+    assert_eq!(rows[0].data["name"], "测试项目");
+}
+
+#[tokio::test]
+async fn test_tenant_isolation_in_dynamic_table() {
+    let test_db = TestDb::new().await;
+    let db = &test_db.db;
+
+    let manifest = make_test_manifest();
+    let entity = &manifest.schema.as_ref().unwrap().entities[0];
+
+    DynamicTableManager::create_table(db, "erp_test_iso", entity)
+        .await
+        .expect("创建动态表失败");
+
+    let table_name = DynamicTableManager::table_name("erp_test_iso", &entity.name);
+
+    let tenant_a = uuid::Uuid::new_v4();
+    let tenant_b = uuid::Uuid::new_v4();
+    let user_id = uuid::Uuid::new_v4();
+
+    // 租户 A 插入数据
+    let data_a = serde_json::json!({"code": "A001", "name": "租户A数据", "status": "active", "sort_order": 1});
+    let (sql, values) = DynamicTableManager::build_insert_sql(&table_name, tenant_a, user_id, &data_a);
+    db.execute(sea_orm::Statement::from_sql_and_values(
+        sea_orm::DatabaseBackend::Postgres, sql, values,
+    )).await.unwrap();
+
+    // 租户 B 查询不应看到租户 A 的数据
+    let (sql, values) = DynamicTableManager::build_query_sql(&table_name, tenant_b, 10, 0);
+    #[derive(FromQueryResult)]
+    struct Row { id: uuid::Uuid, data: serde_json::Value }
+    let rows = Row::find_by_statement(sea_orm::Statement::from_sql_and_values(
+        sea_orm::DatabaseBackend::Postgres, sql, values,
+    )).all(db).await.unwrap();
+
+    assert!(rows.is_empty(), "租户 B 不应看到租户 A 的数据");
+}

crates/erp-server/tests/integration/test_db.rs

@@ -0,0 +1,44 @@
+use sea_orm::Database;
+use erp_server_migration::MigratorTrait;
+use testcontainers_modules::postgres::Postgres;
+use testcontainers::runners::AsyncRunner;
+
+/// 测试数据库容器 — 启动真实 PostgreSQL 执行迁移后提供 DB 连接
+pub struct TestDb {
+    pub db: sea_orm::DatabaseConnection,
+    _container: testcontainers::ContainerAsync<Postgres>,
+}
+
+impl TestDb {
+    pub async fn new() -> Self {
+        let postgres = Postgres::default()
+            .with_db_name("erp_test")
+            .with_user("test")
+            .with_password("test");
+
+        let container = postgres
+            .start()
+            .await
+            .expect("启动 PostgreSQL 容器失败");
+
+        let host_port = container
+            .get_host_port_ipv4(5432)
+            .await
+            .expect("获取容器端口失败");
+
+        let url = format!("postgres://test:test@127.0.0.1:{}/erp_test", host_port);
+        let db = Database::connect(&url)
+            .await
+            .expect("连接测试数据库失败");
+
+        // 运行所有迁移
+        erp_server_migration::Migrator::up(&db, None)
+            .await
+            .expect("执行数据库迁移失败");
+
+        Self {
+            db,
+            _container: container,
+        }
+    }
+}